Privacy Notice

The Hunportal privacy notice consists of two main parts:

• I. Visitor and public-form privacy notice: browsing, cookies, contact, guest advertisements, found-item submissions, category or result suggestions, consent statements and support/payment started as a guest.
• II. Registered user notice: account, dashboard, advertisements, favorites, messages, forum, billing data, support payments and notifications.
• Effective version date: 2026.09.13.

• Data Controller / Service Provider: Xtrade
• Registered seat: 1173 Budapest, 516. utca 2.
• Privacy contact: [email protected]
• Website: https://hunportal.hu

• We process personal data lawfully, fairly and transparently.
• Data is processed for specified, explicit and lawful purposes.
• We request and store only the data necessary for the purpose.
• We strive to keep data accurate, up to date and secure.
• Data is retained only for as long as necessary.

This part applies to website visitors and functions available without registration.

• Purpose: operating the website, troubleshooting, security, statistics and abuse prevention.
• Processed data: IP address, browser, device, operating system, visited URL, time, technical logs, cookie and localStorage data.
• Local weather: the header weather module uses a locality and coordinates estimated from the IP address to display current local weather. The IP-based location may be approximate, especially when using a VPN or mobile network.
• Precise location data: if the visitor previously granted location permission in the browser, the module may use current coordinates supplied by the device. The module does not automatically open a new permission prompt; permission can be withdrawn at any time in browser settings.
• Weather data providers: BigDataCloud is used to determine the locality and Open-Meteo to obtain weather data. During these requests, the IP address and, where precise location was permitted, coordinates may be received by these providers.
• Legal basis for weather location: legitimate interest in displaying locally relevant weather for approximate IP-based location; browser consent for use of precise device location.
• Retention: Hunportal caches the location and weather result only in the visitor’s browser sessionStorage/localStorage; it does not build a separate server-side location history for this purpose.
• Legal basis: legitimate interest in secure website operation; consent for non-essential cookies.
• Retention: technical logs are generally kept for 30-180 days, or until closure in case of an incident or dispute.

• Purpose: displaying providers, businesses, events, venues and public content, making them searchable and facilitating contact.
• Processed data: name, category, description, address data, contact details, website, images and information from public sources.
• Source: submission, authorised representative or lawfully accessible public online source.
• Legal basis: performance of contract or legitimate interest in public information, searchability and contact.
• Retention: while the listing is active; 30 days after deletion or inactivation, or until closure in case of a dispute.

• Purpose: submitting, checking, approving, publishing and administering an advertisement or provider listing.
• Processed data: service name and description, category, subcategory, price, address data, phone, email, website, images, IP address, user agent and approval status.
• Legal basis: pre-contractual steps at the submitter’s request, legitimate interest in moderation and abuse prevention.
• Retention: during publication for active ads; 30 days after deletion, rejection or inactivation; until closure in case of a dispute.

• Purpose: reporting, checking and publicly displaying found items, and helping the owner find them.
• Processed data: item name, description, date found, image, address data, reporter email and phone number, status.
• Legal basis: service provided at the submitter’s request, consent to publication and legitimate interest in preventing abuse.
• Retention: while the report is active; 30 days after handover or inactivation; until closure in case of a dispute or authority request.

• Purpose: receiving, checking and assessing category, subcategory or specific result suggestions.
• Processed data: suggestion type, domain, category or result name, comment, submitter name, email, phone, address data, images, declarations, IP address, user agent and status.
• Legal basis: handling the submitter’s request, consent to publication and legitimate interest in proving authorisation and preventing abuse.
• Retention: until assessment; for approved content while the listing exists; 30 days for rejected or withdrawn suggestions; longer in case of a dispute.

• Support or payment functions on the website may operate through the SimplePay system.
• Some data required for payment is transferred to SimplePay to process, identify, confirm and settle the transaction.
• Hunportal does not store card numbers, expiry dates, CVC/CVV codes or full card data.
• After a successful payment, electronic confirmation, an invoice or a receipt may be issued; after failed or interrupted payment, the User must check the confirmation.
• Refunds, mistaken payments, chargebacks and complaints are also governed by SimplePay, card scheme and applicable legal rules.

SimplePay data transfer statement: I acknowledge that the following personal data stored in the user database of https://hunportal.hu by Xtrade (1173 Budapest, 516. utca 2.) as data controller will be transferred to SimplePay Zrt. as data processor. The scope of transferred data is: name, email address and billing address. The nature and purpose of the data processing activity performed by the processor can be found in the SimplePay Privacy Notice at: https://simplepay.hu/privacy-notices/

• Purpose: contact, answering questions or complaints, customer service and administrative handling, spam and abuse prevention.
• There is no telephone customer service. Contact takes place by email.
• Processed data: last name, first name, email address, phone number, subject, message content, submission time and technical anti-spam data.
• Legal basis: legitimate interest in handling requests; contract performance or pre-contractual step if related to a service; legal obligation for complaints.
• Retention: general requests for 1 year; complaints or disputes generally for up to 5 years.

• Purpose: starting support or payment, processing the SimplePay transaction, confirmation, issuing accounting documents or invoices and complaint handling.
• Processed data: amount, currency, order ID, SimplePay payment link, payment status, payloads, name, email, billing type, billing data and note.
• Card data is handled by the SimplePay payment interface. Hunportal does not store full card numbers, expiry dates or CVC/CVV codes.
• Legal basis: contract performance; legal obligation for billing and accounting data; legitimate interest for abuse prevention and complaint handling.
• Retention: billing and accounting data generally for 8 years; payment logs and transaction data for 8 years, or until closure in case of a dispute.

SimplePay data transfer statement: I acknowledge that the following personal data stored in the user database of https://hunportal.hu by Xtrade (1173 Budapest, 516. utca 2.) as data controller will be transferred to SimplePay Zrt. as data processor. The scope of transferred data is: name, email address and billing address. The nature and purpose of the data processing activity performed by the processor can be found in the SimplePay Privacy Notice at:

• Forum content can be read without registration, and some functions may allow guest likes or content reports.
• Processed data for guest likes: forum topic or reply ID, visitor identifier and time.
• Processed data for content reports: reported content type and ID, reason, comment, source URL, IP address, user agent and metadata.
• Legal basis: legitimate interest in providing community functions, abuse prevention and moderation.
• Retention: until the like is withdrawn or the content is deleted; report and moderation data generally for 1 year, longer in case of a dispute.

This part applies to registered, logged-in users and dashboard use. The visitor provisions also apply to registered users when they use the relevant function.

• Purpose: creating a user account, login, email verification, providing dashboard functions and preventing abuse.
• Processed data: name, email, username, password hash, acceptances, newsletter choice, IP address, account creation and update times, email verification, last login and permission roles.
• Legal basis: contract performance; consent-based newsletter; legitimate interest in security; legal obligation to prove certain consents.
• Retention: while the account exists; after deletion, erasable data is generally deleted or anonymised within 30 days.

• Purpose: displaying and modifying profile data, identifying the user, contact and handling email address changes.
• Processed data: last name, first name, full name, username, email address, email verification status, newsletter and email notification settings.
• Legal basis: contract performance; legitimate interest or consent for notification settings; consent for newsletters.
• Retention: while the account exists, or as long as required by law or for claim enforcement.

• Purpose: submitting, checking, approving, publishing, editing, deleting and administratively reviewing user-linked ads.
• Processed data: user ID, service name and description, prices, category, subcategory, address data, phone, contact email, website, images, IP address, user agent and statuses.
• Legal basis: contract performance; legitimate interest for moderation, abuse prevention and legal claims.
• Retention: while the ad is active; 30 days after deletion or rejection; until the end of the limitation period in case of a dispute.

• Purpose: listing, modifying, rechecking and marking handed-over status for the user’s own found-item reports.
• Processed data: user ID, item name, description, address data, date found, email address, phone number, image, status and timestamps.
• Legal basis: contract performance; consent for publication; legitimate interest for moderation and disputes.
• Retention: while the report is active; 30 days after handed-over or inactive status, longer in case of dispute or authority request.

• Purpose: managing and displaying ads, services, programmes or other results saved by the user in the dashboard.
• Processed data: user ID, favorite item type, favorite item ID and save time.
• Legal basis: contract performance because the favorite function is requested by the user.
• Retention: until the favorite is deleted or the account is closed.

• Purpose: internal messaging, customer service and administrator communication, sending notifications.
• Processed data: owner and partner user IDs, direction, subject, message text, read status, archive, delete or permanent delete status and timestamps.
• Legal basis: contract performance; legitimate interest for administrative and security handling; settings and legitimate interest or consent for email notifications.
• Retention: until deletion or account deletion; after deletion generally 30 days for technical restoration or abuse prevention, longer in case of a dispute.

• Purpose: creating, displaying, editing and deleting forum topics and replies, managing likes, reply notifications and moderation.
• Processed data: user ID, author name or username, forum category, topic title and content, reply content, like data, report data and timestamps.
• Legal basis: contract performance; use of the service for public publication; legitimate interest for moderation and abuse prevention.
• Retention: until content deletion or account deletion; some public content may remain in anonymised form; moderation data is generally kept for 1 year.

• Purpose: handling support or payment started from the dashboard, saving billing data, displaying and downloading documents.
• Processed data: payment and billing data linked to user ID, name, company name, tax number, email, address data, SimplePay transaction data, payment status and document data.
• Legal basis: contract performance; legal obligation for billing and accounting; legitimate interest for complaint handling and abuse prevention.
• Retention: billing and accounting data according to statutory retention periods; saved billing addresses until user deletion or account deletion.

• Purpose: newsletter subscription, unsubscribe, managing subscription status and time.
• Processed data: email address, user ID, active status, subscription and unsubscribe time.
• Legal basis: consent. Consent can be withdrawn at any time via the unsubscribe link, dashboard setting or privacy contact address.
• Retention: until unsubscribe; after unsubscribe, data needed to prove unsubscribe is kept for up to 5 years.

• Hostinger International Ltd. / Hostinger service group: hosting, server operation, database and technical log storage, mailing service.
• BigDataCloud Pty Ltd.: approximate IP-based locality detection and conversion of permitted device coordinates into a locality name for the weather module.
• Open-Meteo: providing current weather data for the determined coordinates.
• SimplePay Zrt.: processing payment transactions, payment status and transaction identifiers.
• Cloudflare, Inc. / Cloudflare Turnstile: form protection, bot and spam protection, abuse prevention.
• Google Ireland Limited / Google LLC: Google Analytics and Google Ads services only with appropriate consent.
• Meta Platforms Ireland Limited / Meta Platforms, Inc.: Meta Pixel, Facebook and Instagram advertising and campaign measurement services only with appropriate consent.
• The billing service provider is a recipient if the relevant invoice or receipt is actually issued or handled through it.
• Lawyer, authority, court, conciliation body, bank or card scheme in case of legal obligation, complaint, chargeback, dispute or authority request.

• The Controller transfers personal data to a third country or international organisation only with appropriate GDPR safeguards.
• The actual data processing locations and safeguards of Hostinger, SimplePay, email, spam protection, analytics and other technical providers must be specified according to provider terms.
• SimplePay privacy notices: https://simplepay.hu/privacy-notices/

• Strictly necessary cookies and localStorage data: session, login, CSRF protection, security, language or operating settings, GDPR consent and consent version.
• Cloudflare Turnstile technical data: browser and device signals needed to protect forms and filter bot traffic.
• Functional cookies and browser storage: remembering convenience settings, interface states and the weather module’s short-term location and weather cache.
• Google Analytics cookies and similar technologies for statistics only with consent. Hunportal measurement ID: G-J506PLG1XK.
• Google Ads, Meta Pixel, Facebook and Instagram cookies may be used for ad measurement, conversion tracking and remarketing only with prior consent.
• Consent can be modified or withdrawn at any time in cookie settings or by deleting cookies in the browser.

• The Controller processes data in permission-based administration interfaces, databases and hosting.
• Administrator and masteradmin access is tied to permission scopes, and sensitive operations may be logged.
• The Controller strives to use HTTPS, security updates, backups, logging, spam protection and access restriction.
• In case of a data protection incident, the Controller fulfils GDPR obligations and, where necessary, notifies NAIH and affected persons.

Data subjects may exercise their rights through the privacy contact address. The Controller generally responds to requests within one month.

• Access: information may be requested on whether the Controller processes personal data.
• Rectification: inaccurate or incomplete data may be corrected or supplemented.
• Erasure: deletion of personal data may be requested if there is no retention reason.
• Restriction: the data subject may request that the Controller only store the data.
• Objection: the data subject may object to processing based on legitimate interest.
• Portability: for automatically processed data, a machine-readable copy may be requested.
• Withdrawal of consent: processing based on consent may be withdrawn at any time.
• Complaint and remedy: the data subject may lodge a complaint with NAIH and turn to court.

• Privacy contact: [email protected]
• Supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
• NAIH seat: 1055 Budapest, Falk Miksa utca 9-11.
• NAIH mailing address: 1363 Budapest, Pf. 9.
• NAIH website: https://www.naih.hu
• The data subject may also turn to court if they believe the processing of their personal data is unlawful.

• The Controller may amend the privacy notices, especially in case of legal changes, new functions, new processors, new payment or cookie services.
• The currently effective notices are available on the website.
• In case of material changes, the Controller strives to inform visitors and registered users in a clearly visible way.